start	end	text
6650	9830	My name is Fyodor from Insecure.org.
9830	11290	Can you guys all hear me?
12270	13230	No?
13730	15450	Then listen up!
17890	19390	Alright, well...
21610	23650	Alright, well thank you all for coming.
23890	26790	DEF CON is always a blast, and it's an honor to be here
26790	31050	giving the opening talk to start out the conference.
31050	34550	This year I'm going to talk about NMAP hacking.
34890	39370	Basically, there are a lot of security people who use NMAP
39370	42270	but many of them don't understand its full power.
42770	44890	And NMAP deserves a lot of the blame for this
44890	48250	because it kind of is too helpful sometimes.
48250	52470	If you do a scan, such as nmap-scanme.nmap.org
52470	56630	you're leaving NMAP to worry about deciding on the scan type
56630	59690	the timing options, the output format
59690	64710	the target ports, the source ports and addresses, and more.
64930	68610	While that's helpful, reducing that complexity
68610	70730	in terms of making NMAP easy to use
71370	75570	it's also troublesome in terms of a lot of people never explore
75570	79250	the literally hundreds of advanced options that NMAP has
79250	82590	for making your scan more effective.
82590	86010	So in this presentation, I'm basically going to go over
86770	91150	three real-world common examples and scenarios
91850	95170	and then I'm going to demonstrate how you can use NMAP effectively
95170	99230	to solve them, with an emphasis on options
99690	102090	that are a little bit off the beaten path.
102090	107130	I'm also happy to be releasing a new version of NMAP
107130	109110	special for DEF CON.
109710	115410	NMAP version 3.83DC13 is available at this URL here
115410	118610	you definitely want to get the one on the web rather than the CD
118610	120630	as it's a lot newer.
121270	124310	It has a lot of cool features, which I'll talk about
124310	126790	in this presentation shortly.
128650	131410	Also, I'm going to give early warning now
131410	136990	that this presentation does use real uncensored IP addresses and host names
137550	140950	that's because I trust you guys not to abuse the information.
142370	142810	Also...
144310	146970	Okay, okay, but if there are any black hats in the room
146970	149210	who would use this information maliciously
149210	152370	then I'm sorry, but I'm going to have to ask you to either leave
152370	156690	or when the IP addresses come on the screen, just cover your eyes.
157390	159030	I'd appreciate that.
159670	162470	Before I begin, it would help me to get an idea
162470	166510	of how much introductory NMAP material I need to cover.
166790	170170	So if I could get a show of hands for anyone here who has ever used NMAP
172710	175050	All right, everyone.
175110	176790	So we'll skip NMAP for dummies
176790	180870	and move directly to Host Discovery.
185090	187910	Host Discovery covers the real common case
187910	189810	where you just want to look at a network
189810	193370	and find all the hosts on that network that are online.
193370	196270	Maybe you're a pen tester who just busted into a new subnet
196950	199010	and wanted to see what machines are on.
199010	202850	Or maybe you're a network administrator doing IT inventory.
202850	204930	Or maybe you're going to do a more intensive scan
204930	207230	but you want to figure out what hosts are up first
207230	209910	so you can focus your efforts on those.
211530	215510	NMAP used to only be able to send an ICMP echo request message
215510	219230	and later a TCP ACK to a port.
220010	222290	And at the time, you know, that was useful
222290	225510	and that's still the default
225510	228790	because there was a time when NMAP could send a ping request
228790	232670	and expect that the vast majority of hosts would respond.
232670	235450	Unfortunately, that time is well past.
236110	238430	Many hosts, you know, don't respond to a ping
238430	241990	even though the RFCs say that they should.
241990	245770	The Internet is a much more guarded and filtered place nowadays.
246050	248830	Fortunately, NMAP has also evolved with the times
248830	252050	and offers a wide variety of options
252050	255650	to make your host discovery more powerful.
255650	257850	For example, you can send SIN probes
258630	262030	if you want to get through a stateful firewall
262030	264290	that only allows SINs.
264490	266130	You can send ACK probes
267330	269350	for those stateless firewalls
269350	272610	that watch for SIN packets but can't tell
272610	275630	that the ACK is not part of an established connection.
275790	277390	UDP probes you can send
277390	280670	and all three of these types you can send to a big list of ports
280670	284430	in the hopes that you'll find just one of them that's responsive.
284430	287430	Also ICMP echo requests and pings,
287430	290190	timestamp requests, netmask requests,
290190	292470	so you have a whole lot of options there.
292690	295830	And you can combine those options almost arbitrarily.
295830	299170	But with so many options, that leaves you to the question of
299170	301570	well, what's going to be most effective?
301730	304910	And sure, I can speculate on what might be most useful
305210	307930	or what networks I've seen have available
307930	312310	but the best way to answer these questions is empirical results.
312310	316610	So let's start with what are the most valuable TCP ping ports to use?
316670	319730	I did a scan of more than 10,000 IPs
319730	321570	on the internet using
321570	323810	NMAP's random target selection option
323810	326770	and I took that and looked at just those hosts
327110	330470	that are heavily filtered because the unfiltered ones
330470	332530	we're going to be able to find anyway.
333190	336330	And of those I said, hey, which hosts,
336330	339490	which ports are most responsive to a SIN packet?
339490	342110	And this is the list starting with the most common
342110	343910	which is HTTP.
346780	349980	SMTP is also popular. SSH.
351280	353380	HTTPS. FTP.
354480	357560	Telnet's down there, but it's nice to see it below SSH.
358600	360120	And these are the sort of things
360120	361680	that you would expect to see.
361680	365200	If you have your firewalled host, you still have to have port 25 open
365200	366760	if you want to receive mail.
366760	369160	A lot of times they make 22 widely open
369160	371780	so if they're off it, but Defcon's a bad example.
371780	375380	But if something bad happens while you're away, you want to be able to connect in
375380	377620	and remotely administer.
378640	382220	So your best bet is to pick a variety of these.
383160	384300	The next question then is
384300	386520	what sort of TCP probes do I want to send?
386520	389020	There's the SIN probes and the ACK probes.
389020	390780	The answer is just send both.
390780	395200	That way if it's the stateful firewall, like Microsoft.com
395200	397560	your SIN will get through, but your ACK won't.
397560	400540	Whereas a stateless firewall, your ACK's more likely.
400540	402840	So send them back. All you need is one response
402840	405740	to tell you that the host is open. So send them both.
406480	408180	What about UDP ports?
408380	411000	Here you have a little different idea than with TCP.
411020	413820	With TCP, an open port is still responsive
414320	416440	so it tells you that the host is up.
416440	419360	With UDP, NMAP's blank UDP messages
419360	422960	are unlikely to elicit a response from an open port.
423140	425500	And so you don't want to hit an open one.
425500	427820	So your best bet is probably just to pick a high port
427820	430080	like 22,131 or whatever
430780	432800	that's less likely to be filtered.
432880	436700	And a little exception to the rule is you might want to try 53 as well
436700	439040	just because DNS is so common.
439340	441500	Yes, if it's open you probably won't get a response
441500	445760	but sometimes administrators open it for a whole section of network
445760	449000	and so from those machines that aren't running DNS servers
449000	450860	you can still get through.
451220	454600	For ping types, I would recommend an echo request
454600	459040	and then either a timestamp request or a netmask request.
459140	460760	The idea is that some hosts
460760	462980	for example Google or Insecure.org
462980	464880	will let you ping them.
464880	467440	Whereas there are other hosts that have said
467440	470060	hey, I'm going to block pings but they do it poorly
470060	473440	and they forget about the sister options like timestamp request
473440	474980	and netmask request.
474980	479060	But the ones who block the latter are likely to block them both.
479080	481220	So your best shot is generally to do both
481220	485020	or to do a ping request and then one of these others.
485500	487200	So let's put that all together.
487200	491600	Take all of these ideas and put it into one intense discovery combination.
491720	493940	And here's one that I would recommend.
493940	496660	Here we're doing an echo request, timestamp
497300	499460	a variety of SYN probes, ACK probes
499460	502480	and also setting the source port 53.
502480	507140	You never know when that little trick will work to get through poor configurations.
507480	509320	One thing to note when doing this
509320	513180	is that this is 13 probes rather than 2.
513360	515420	And host enumeration time is going to be
515420	518420	roughly proportional to the number of probes that you send.
518700	522720	And so you want to consider whether it's worth it.
522720	525380	But in many cases you really do want a comprehensive list
525380	527700	so it's worth taking a little longer.
527960	530560	And like I said, speculation is all well and good
530560	534580	but when you're deciding whether you do want to spend the extra time
534580	536020	or what's going to be most effective
536560	539180	empirical data is the best to have.
539320	540820	So I did a test.
545230	548070	I used the random target option again
548070	551810	to generate a list of 50,000 random IPs.
551810	555850	And then I ran it and mapped with the default scan types.
555850	557310	And it chugged away and chugged away
557310	561430	and eventually it said, OK, out of those 50,000 IP addresses
561430	564810	1,770 are up.
564810	568290	Alright, so now let's try it with the more intense discovery.
568510	570030	We use all these probes
570030	571970	and suddenly instead of 1,700
572650	576010	it gets 2,698 hosts up.
576050	578030	So we see a 50% improvement
579310	582330	just by adding these extra options.
582590	584330	And yes, it did take four times as long
584860	588390	but in many cases, if not most, it's worth it for you
588390	591350	because you really want to find all of the hosts.
592530	592990	And...
595110	597670	there are a couple notes that I want to make
599030	600630	regarding this sort of scan
600630	602350	and these results that we've found.
602450	605890	One is that it's not quite as exciting as it seems
605890	609590	because some of these 2,698 hosts
609590	611890	are going to be network artifacts.
611890	615850	For example, in my last DEF CON talk
615850	619270	I showed an example where a host that was a firewall
619270	622150	was spoofing reset packets
622150	624750	to any probe sent to port 113
624750	627690	on any of the hosts behind it.
627830	630270	And so some of these are network artifacts
630710	633790	and you'll have to use the sort of techniques I talked about last time
633790	638050	to discern which are the artifacts and which are the actual hosts.
638170	640270	The other thing worth noting is that
640270	643090	these techniques will give the most improvement
643090	646610	in a case like this where we're doing a worldwide scan
646610	649870	over the Internet against tons of firewalls
649870	651250	and filters and such.
651250	655350	If you're scanning a local LAN, the defaults may work fine.
655890	657610	But while we're speaking about
658470	660450	scanning a local Ethernet LAN
660450	663930	that crops up with its own big bunch of issues.
664470	666190	Here I do an nmap command
666910	670650	for a ping scan of a host on the Ethernet LAN
670650	672530	that's not really up.
672690	675410	Send IP is a new option that I'll talk about later
675410	678370	but for now you just need to know
678370	680330	that that does the same default behavior
680330	682750	as all of the pre-DEF CON releases.
683450	687470	So I run nmap and I've pasted in
687470	690470	some ethereal output to kind of show
690470	692510	what's going on under the covers.
692510	694450	I give the OS an IP packet.
694490	698750	It sends an ARP request looking for the machine immediately.
698850	701950	Then after one second it sends yet another ARP request
702450	705470	and after two seconds it sends a third ARP request
705470	707950	and finally it gives up and nmap ends
708470	710450	after just over two seconds.
711250	714190	And there are a couple of problems that...
715630	718050	Can you guys hear me better?
718590	719870	All right.
719870	723410	There are a couple problems with this two seconds.
723410	725390	You know it may sound, oh two seconds, big deal
725390	728350	but if you're scanning 10.0.0.0.8
728350	733150	that's 16 million hosts and two seconds is gonna add up.
733230	735370	Even 192.168
735370	738150	is still 65,000 hosts and nmap
738150	741470	scans these in parallel but still it's not as fast
741470	745790	And it's wasting time waiting for these ARP requests.
745850	750270	Another problem is that most operating systems, you know, they have an ARP table
750270	752250	and that ARP table is finite.
752430	757770	So when they have an incomplete entry such as this, they'll add,
757770	759590	that ARP table will fill up.
759590	762870	And sometimes NMAP has to wait, you know, as much as 4 minutes
763470	766350	for those ARP entries to expire.
766450	768550	You may have seen that if you scan a big network.
768550	771670	NMAP is like, hey, I can't send right now, waiting 60 seconds,
771670	773470	then waiting 120 seconds.
773510	775270	It's very frustrating.
775750	779770	And since scanning your own local LAN is extremely common,
779770	781990	that's something that's worth optimizing.
782510	787530	And so one of the features in the new NMAP is ARP scanning.
787650	791810	The idea is give NMAP full control to send those ARP packets.
791810	795470	That way NMAP can worry about the timing and the retransmissions.
795470	800450	It can skip over the ARP table for the OS entirely
801230	803610	and do the scan a lot faster.
803770	807010	Another advantage, not only is it much faster,
807010	808450	but it's more accurate.
808570	811950	You know, as we've already seen, many hosts have all sorts of filters
811950	814670	that can block your host discovery packets.
814670	816970	But if they want to communicate on the network,
816970	819570	they generally have to reply to ARP.
819570	823650	So if NMAP gets an ARP reply, it knows that it's online.
823650	827010	So here's a quick example I have here,
827750	832070	where I scan the same machine as before with the new NMAP,
832070	834910	and instead it sends one ARP at the beginning,
834910	837870	and then one ARP after a tenth of a second.
837870	840750	And then it gives up in two tenths of a second.
840750	844990	So it takes, you know, less than an eighth of the time that it took before.
845610	848730	I can try and do a live demonstration here,
848730	852610	which is always risky at a conference, but we'll give it a try.
852610	855390	So here I'm doing NMAP, a ping scan.
855390	857510	I probably have to make this bigger, don't I?
858450	859990	Or can you guys read it?
861330	862190	All right.
873470	875150	All right, huge we are.
875570	878530	So I'm going to do a...
879230	880750	What a mess this is.
880990	882970	So I'm going to do a ping scan.
882970	884810	PR is the new ARP feature.
884810	889810	And I'm going to scan the wireless network that I'm on now with aggressive timing.
890390	891610	And so it goes.
891610	893670	It starts showing you the machines that are up,
893670	895830	and it shows you their MAC addresses.
895830	898190	Right now we're only seeing one,
898190	900630	because I'm just scanning this short subnet.
900870	904610	But we see that it finished and showed that Dell guy.
905550	910390	Another tool that you can use to do this sort of scanning is THC Root.
910390	911970	How many people have used that?
912950	916290	It's a nice little tool by the hacker's choice.
916570	918850	So here I'm going to do the same scan.
918850	921310	And I'll make it huge again.
923170	924890	With THC Root.
928550	930690	And again, it goes through.
930890	933450	It finds the gateway machine.
934070	935930	And it thinks and it thinks.
935930	938610	But you can see that it's taking a bit longer.
938610	940650	NMAP took five seconds and it took ten.
940650	941970	Which is no big deal.
941970	945790	But on a large scan, you know, having it go faster is a lot helpful.
947170	950330	But it's worth noting that while NMAP may be faster,
950330	953630	THC Root still has a lot of great things going for it.
953630	957070	For example, I compiled it just recently.
959250	962070	And you can see all the configure screens.
962230	965510	And at the end, it gives you this beautiful ASCII art
966930	970710	of a giant monster holding a white hat severed head
970710	973730	who's screaming, help, help, I'm just stupid white hat.
973730	975230	Please don't hurt me.
975750	979330	So NMAP can't quite compete with their ASCII art.
980670	982170	Or can it?
982250	985830	Yes, I'm pleased to announce that the new DEF CON version...
986890	989730	Yes, we've got the ASCII art for you.
989730	991390	It's just not quite as violent.
993270	995010	So that's ARP scanning.
995010	999010	And another feature I added just for you guys is ARP spoofing.
999110	1002210	When you've been kicked off as many networks as I have,
1002210	1007930	you start to appreciate the values of stealth and misdirection.
1007930	1010570	So say you're sitting in a conference room
1010570	1014130	and you've got the only ThinkPad.
1014290	1015610	Unlikely, I know.
1015970	1018510	And all of a sudden, a big scan starts
1018510	1021630	and everyone sees the MAC address is registered to IBM.
1021710	1023910	You know, heads will turn in your direction.
1024110	1025970	So with the new spoofing option,
1025970	1028210	I did this at the hotel last night.
1028350	1030390	I specify spoof MAC Apple
1030930	1033470	and NMAP looks through the OUI table,
1033470	1038350	finds the MAC prefix registered to the company you specify,
1038350	1040630	fills out the last three bytes randomly,
1040630	1043090	and then you can point at the Apple guy and say,
1043090	1044190	it must be him.
1049180	1050060	Thanks.
1051600	1054520	You can also specify it, you know, in other formats.
1054520	1056820	If you want to specify a specific MAC address
1056820	1059500	or just give another prefix, it'll fill in the rest.
1059500	1063200	Or just give it zero and it'll give you a fully random MAC.
1063200	1066260	And it shows you down here what MAC that it selected.
1069100	1071460	So that's basically host discovery.
1071460	1074600	As you can see, there are a lot of different options that you can do there.
1074600	1076500	A lot of different things to play with.
1076520	1079340	And by manipulating these different options,
1079340	1082660	you can get much faster and more accurate results.
1082960	1087180	Now let's look at another common scan.
1087180	1089240	And that's single host discovery.
1089660	1093340	Say a new vulnerability comes out in some product.
1093340	1096400	You want to scan your network before the bad guys can
1096400	1100600	and identify all instances of the vulnerable product.
1100600	1102780	Or maybe there's a new worm going around
1102780	1105700	and you want to scan to find infected hosts
1105700	1109600	before they can do much damage so you can quarantine them.
1109700	1112880	Or maybe you're doing forensics on a compromised host
1112880	1117640	and you find that they've left a backdoor open on some unusual port.
1118040	1119400	Well, scan your network real quick
1119400	1122180	and maybe you'll find other compromised machines
1122180	1124260	that have the same backdoor.
1124260	1126740	So here we're going to do an example of this,
1126740	1130320	which is a little bit unusual, but basically covers the idea.
1135600	1138940	Our mission statement is to locate web servers
1138940	1142600	on the playboy.com network offering free images.
1143540	1146800	The idea here is that I was thinking,
1146800	1150200	hey, you know, they charge $10 a month for their content or whatever
1150200	1151540	and I'm a cheapskate.
1151620	1155660	Maybe they have a development server or a staging server somewhere
1155660	1159520	where you can download all the images for free.
1159720	1161400	You know, it's worth a try.
1161700	1163320	So how are we going to do this?
1163320	1165360	Well, first we need the address to scan,
1165360	1166240	and that's pretty obvious.
1166240	1170080	Just do a lookup on Aaron for netblocks owned by Playboy.
1170340	1175740	The first one we get is this slash 20 of 4,096 hosts.
1175780	1178000	There are a lot more netblocks they have,
1178000	1181860	but for this example, that's enough for us.
1182440	1184960	And so let's give it an initial try.
1184960	1186280	We're going to do nmap.
1186280	1189400	We'll say don't ping because we're only scanning one port.
1189400	1191680	The ping would take longer than the scan.
1192140	1193720	The port is 80.
1193900	1196220	Save the results in grepable format
1196220	1199200	so we can easily grep out the open servers.
1199200	1200740	And then we give it the network.
1200740	1203200	And it chugs along and it completes,
1203200	1205060	but it takes 20 minutes.
1205280	1208320	You know, even for 4,096 hosts,
1208320	1210180	you know, that's longer than I want to wait.
1210600	1213480	So how can we speed that up?
1213480	1215760	One thing you can do is help
1215760	1217500	by giving nmap timing information
1217500	1219400	that it is trouble getting itself.
1219420	1222880	On a responsive network, on your local LAN or whatever,
1222880	1224800	you can usually...
1224800	1227640	nmap is able to calculate its own response times
1227640	1229400	based on the responses it's getting
1229400	1232240	and usually optimize those pretty effectively.
1232240	1234120	But when you're scanning over the Internet
1234120	1238300	on a highly filtered network,
1238300	1240580	nmap's not actually getting much responses.
1240580	1242900	And so it doesn't really have a good idea
1242900	1244440	of how long it has to wait
1244440	1247360	before it can time out and retransmit.
1247700	1249120	So the idea here is
1249120	1250900	we'll try and figure out some of that ourselves
1250900	1254160	and then we'll pass that information along to nmap.
1254280	1256300	So I look for hosts on the network.
1256300	1257560	First I try their web server
1257560	1259820	and I see that that's on a different IP,
1259820	1260980	so that's no good.
1261020	1262500	So then I look for MX servers
1262500	1265020	and we lucked out, there are two of them
1265020	1267860	that are both on the networks we're trying to scan.
1268060	1270920	Normally I might just take one host on the network,
1270920	1272960	but here, you know, we don't know a lot about
1272960	1274860	the network configuration.
1275000	1276820	And also given the names,
1276820	1279180	we can tell that this one's probably in Los Angeles
1279180	1281120	and this one's in Chicago,
1281480	1284760	so the latencies are likely to differ dramatically.
1284820	1286880	So how do we figure out the latencies?
1286940	1288780	Well, let's ping the hosts.
1289400	1290640	Well, we try that,
1290640	1293500	but they both say 100% packet loss.
1293500	1295000	They're blocking our pings.
1295040	1296400	Well, that's a bummer.
1296860	1298760	But, you know, they're mail servers,
1298760	1301020	and so they've got to have port 25 open.
1301420	1302920	So let's use HPing 2
1302920	1304880	to do a TCP ping
1304880	1308040	of those ports and see how long that takes.
1308200	1310100	So we say HPing 2,
1310100	1312320	send a SYN to port 25,
1312320	1314020	like we're opening a connection,
1314020	1315240	send five of them,
1315240	1316900	and we do it to both the Chicago
1316900	1320160	and the LA networks.
1320980	1323100	And here, the information you really want
1323100	1325220	is not the fastest time,
1325220	1327020	it's not the average time,
1327020	1330440	it's the longest time that any of those pings take.
1330480	1333020	Because you want to be a little bit conservative here.
1333020	1334820	If you try and get too aggressive,
1334820	1336560	you'll actually make the scan take longer
1336560	1338680	because Nmap will be retransmitting
1338680	1341580	when the response is in transit.
1341860	1344680	So even though the longest we saw out of these two
1344680	1346920	was 61 milliseconds,
1346920	1348120	you know, LA is a lot faster
1348120	1350440	because I was scanning from California,
1350440	1352100	we're going to pick a bit higher numbers
1352100	1353520	to be on the safe side.
1354040	1355560	So we're going to say the max
1355560	1357680	RTT timeout is 200,
1357680	1360400	so we'll wait up to a fifth of a second.
1360480	1364340	And we tell Nmap to start out with 150 milliseconds,
1364340	1366520	so that Nmap will only go up to 200
1366520	1368160	if it needs to.
1368160	1369680	And Nmap can still go faster
1369680	1371660	if it determines that it can.
1371800	1373540	Another optimization is to say
1373540	1375060	scan in bigger groups.
1375060	1377500	We're going to specify a minimum host group size
1377500	1379620	of 512.
1379960	1384400	That breaks up the 4,096 machines
1384400	1387280	into 8 groups of 512
1387880	1390100	and allows Nmap to go much faster
1390100	1393380	by more efficiently handling them in larger groups.
1393760	1396340	And the rest of the options are pretty much the same.
1396340	1397800	So how long does that take?
1397800	1398900	Nmap chugs away
1398900	1403060	and it still takes almost 15 minutes.
1403140	1405820	That's better than 20 by a long shot.
1405820	1406600	But let's be honest,
1406600	1408220	when I'm looking for these free images,
1408220	1409820	I'm not a patient guy.
1410660	1412520	This is an urgent matter.
1412520	1415260	And so I say,
1415260	1418080	how can we make it a bit faster here?
1418840	1420780	Well, think about what Nmap is doing
1420780	1423120	under the covers in this case.
1423180	1424320	Nmap, you may know,
1424320	1427140	does reverse DNS resolution by default.
1427480	1430540	And when I'm doing P0 scans, no ping,
1430540	1432060	that means that Nmap is considering
1432060	1433400	all of the hosts up.
1433400	1435460	And so it's doing a reverse DNS resolution
1435460	1437740	on every host.
1437780	1439520	And reverse DNS, I'm afraid,
1439520	1441720	is one of the few Nmap functions
1441720	1444060	that's not yet parallelized.
1444060	1446620	So that may be taking quite a lot of time.
1447040	1449160	So I do the same scan,
1449160	1450640	but this time I add hyphen N
1450640	1453360	to get rid of reverse DNS resolution.
1453620	1455680	And here we see that it only takes
1455680	1457220	about three minutes,
1457220	1458060	which is perfect,
1458060	1459980	because that's about as long as I last.
1460520	1463720	And so,
1463720	1467800	by just manipulating these different values,
1467800	1469640	we've been able to reduce the scan time
1469640	1472520	from 20 minutes to only three.
1472720	1473940	But enough about timing.
1473940	1475300	Let's look at the results.
1476480	1479360	We did that big scan of 4,000 IPs,
1479360	1483160	but we only found two that are open.
1483320	1485500	Well, that was sort of a little bit worrisome,
1485500	1486500	but you never know.
1486500	1487760	Maybe they're good ones.
1487800	1489580	Let's take a look in Firefox.
1496140	1498000	So we'll go to the first one,
1498000	1501640	which is 216.163.140.20.
1503080	1507160	And we see Microsoft Outlook Web Access.
1507660	1509520	Now, that would be really exciting
1509520	1511400	if we were trying to break into their network,
1511400	1513000	but it's not very gratifying
1513000	1515320	for our particular goal here.
1516680	1518200	What this does tell us
1518200	1520140	is that, hey, maybe the network we scanned
1520140	1521480	was the corporate network
1522940	1524620	when we really should have been scanning
1524620	1526240	the production network.
1527200	1529100	It is nice to note their cute little
1529100	1533300	Playboy mail logo up in the URL bar.
1535200	1536820	But all is not lost
1536820	1539720	because we still have one more site.
1539720	1541200	And I'm very pleased to report
1541200	1543800	that that one has gigabytes of free images
1543800	1545240	that I downloaded immediately
1546440	1548320	upon download.
1552460	1555440	In fact, I think I'll even show you.
1557400	1565220	So this one is 142.135.
1565680	1568180	And so here it chugs away.
1568680	1573680	And we see FreeBSD ISO images right over here.
1573680	1577740	We see Fedora images, lots of them.
1577740	1579880	And if you're on the kinky side of things,
1579880	1581440	they've got the whole Perl network
1581440	1583460	right around here.
1583460	1585100	So whatever your tastes,
1585100	1588300	this is a great site to download images.
1588300	1589880	And I would also like to mention
1590460	1593720	this is also named mirrors.playboy.com
1593720	1595760	and it actually is a real valuable site
1596310	1598920	that I use when I need a download.
1600980	1604740	So we can say mission accomplished on that goal.
1604920	1607460	But let's look at another quick
1608260	1610780	single-service discovery option.
1610780	1613060	And that's NMAP's version detection.
1613420	1616440	In many cases, you want to not just know
1616440	1618380	what ports open, but you want to find out
1618380	1621080	the exact service that's listening.
1621100	1622720	And so with version detection,
1622720	1626900	instead of browsing the well-known ports table,
1626900	1628740	NMAP actually interrogates the ports
1628740	1631860	and tries to figure out what's running there.
1631860	1633800	And so that way you can maybe distinguish
1633800	1637000	the vulnerable services from the invulnerable ones
1637000	1640040	or find the services even if they're listening
1640040	1642140	on a non-default port.
1642480	1645540	And NMAP now has well over a thousand
1645540	1647760	different version detection signatures
1648740	1651980	to identify all sorts of crazy things.
1652320	1655800	In this example, this is just one
1655800	1657280	that someone sent last year
1657280	1660340	when MyDoom was basically causing havoc.
1660600	1662020	Right when it was released,
1662020	1664020	he posted this to the NMAP dev.
1664020	1665300	Here's a probe you can add
1665300	1667860	so that you can identify compromised machines
1667860	1670200	or infected machines.
1670640	1673060	So I'm just showing this as an example
1673060	1674780	to show that it's actually pretty easy
1674780	1676720	to add your own custom identification
1676720	1678800	if you want to add services
1678800	1681080	that aren't in the official file.
1681600	1683960	So you just say, do a TCP probe.
1683960	1685400	We'll call it MyDoom.
1685400	1688600	These two bytes are the data that you need to send.
1688820	1691540	These are the ports that it normally listens on.
1691640	1694180	And you'll match for service MyDoom.
1694180	1696880	If you get this back in the response,
1696880	1698580	the program is MyDoom.
1698580	1699580	And for the version number,
1699580	1700580	he just put, you know,
1700580	1702380	the date it was found in the wild.
1702880	1705220	So that's a real useful thing to add.
1705220	1706060	And to add it,
1706060	1708960	all you do is add this little s, capital V,
1708960	1711640	and NMAP does the rest of the work for you.
1712340	1716020	So that's enough for single-service scanning.
1716360	1718020	Let's try something a little different
1718020	1719340	that's also common.
1719340	1721700	What if you want to defeat a firewall?
1721700	1723580	Sometimes you really want to look at
1723580	1725460	what ports are open on a machine,
1725460	1728680	but those pesky firewalls can get in the way.
1728920	1730680	And NMAP has some techniques
1730680	1733340	that can help you resolve that problem.
1733340	1735160	So we've got another mission.
1735460	1738520	This time we want to discern the open TCP ports
1738520	1741280	on docserv.caldera.com.
1741500	1745060	Now I was a little reticent about using SCO as an example
1745060	1748400	because at one time,
1748400	1751800	they were kind of considered a threat to free software.
1751800	1753300	But lately, you know,
1753300	1755440	their litigation is in shambles.
1755440	1757780	And they're pretty much a laughingstock.
1757780	1760440	And so it feels kind of like beating a dead horse.
1761320	1763740	The problem is, it's so useful
1763740	1767000	because every time I want to find
1767000	1769480	like really pathetic network configuration,
1769480	1771740	you know, I can find an example right there.
1772560	1774540	Also, they are a fun horse to beat,
1774540	1776020	so let's do it.
1778040	1780200	If we want to find the open ports,
1780200	1782740	the first thing we're going to want to do is a SIN scan.
1783340	1784740	You know, that makes sense.
1784740	1785560	It's the default.
1785560	1787000	It's often the most useful.
1787040	1789160	So we do a SIN scan against the machine.
1789160	1793580	We find port 80 open, port 5007 open,
1793580	1795880	and 113 is closed.
1795880	1797240	So did we do it?
1797240	1798180	Well, not really.
1798180	1800900	Because while we figured out the state of three ports,
1800900	1804760	the 1660 remaining ones are in the port filtered,
1804760	1805900	are in the state filtered.
1805900	1808100	So we don't know if they're open or closed.
1808220	1810980	It's worth noting that in a real scenario,
1810980	1813700	you would probably want to add hyphen P hyphen,
1813700	1816620	so that it will scan all 65,000 ports.
1816680	1818760	But just like with the Playboy example,
1818760	1822560	I'm limiting it just to be a useful example.
1822720	1824220	So we've got three,
1824220	1827700	but there's still a huge number that we've not really determined.
1827720	1830140	Those ports could be open and exploitable,
1830140	1831380	those 1660,
1831380	1832440	or they could be closed.
1832440	1833600	We just don't know.
1833600	1835380	So what do we want to try next?
1836640	1838540	Let's try a different type of scan.
1838540	1840420	Let's try the FIN scan.
1840420	1843300	That basically sends a FIN packet,
1843300	1845960	and if it receives a reset back,
1845960	1848240	the port is probably closed,
1848240	1850220	whereas if we get nothing back,
1850220	1853240	the port is either filtered or open.
1853240	1855160	And this isn't true of all machines,
1855160	1858260	since some of them aren't susceptible to this issue,
1858260	1859560	but it's true of a lot of them,
1859560	1860980	so it's worth trying.
1861100	1863100	So we try it against DocServe,
1863100	1864140	and as you can see,
1864140	1866500	we get a whole big long list of ports
1866500	1869200	that are either open or filtered,
1869200	1872560	and then the rest of them are in the state closed.
1872860	1874420	So that's very interesting.
1874420	1877080	It's limited the number of ports quite a bit here
1877080	1878640	to just a few dozen
1879140	1881300	that are either open or filtered.
1881380	1883460	And one would hope that most of those
1883460	1885240	are actually in the filtered state,
1885240	1886600	because it would be pretty pathetic
1887120	1888700	to have that many open,
1888700	1889740	but this is SCO,
1889740	1891240	so you never really know.
1891680	1893640	So how are we going to figure out,
1893640	1894720	differentiate,
1894720	1897180	because it's a very important distinction,
1897180	1899100	whether the port is open or filtered.
1899180	1902160	Well, let's try yet another type of scan against them.
1908120	1910560	This time, we're going to try an ACK scan
1910560	1912200	against DocServe.
1912220	1914380	And that sends an ACK packet,
1914380	1916380	and if it receives a reset back,
1916380	1918460	it knows that the port is unfiltered,
1918460	1919810	because it got a response,
1920160	1921860	whereas if it receives nothing back,
1921860	1924460	or an ICMP port filtered message,
1924460	1927940	it knows that it's filtered.
1928600	1931140	And so this gives us a lot more information.
1931140	1933460	Here, the vast, vast majority
1933460	1935100	are unfiltered,
1935100	1937080	but it tells us that just two of them
1937080	1938640	are filtered.
1939220	1941440	So what's an interesting thing you can do
1941440	1943000	is combine those
1943000	1945760	by looking at the last results
1945760	1947580	and comparing them with these.
1947580	1949880	For example, look at port 135.
1949960	1951800	Here it says filtered,
1951800	1953200	whereas before,
1953200	1955980	135 was open or filtered.
1955980	1958760	Well, if you kind of take the logical end of those,
1958760	1959800	you see that it's
1959800	1961860	got to be filtered.
1962860	1964560	Similarly, 1434
1964560	1967040	looks like it's really filtered.
1967240	1968860	Let's take another example.
1968860	1971000	Say you want to know about the SSH port,
1971000	1971840	22.
1971840	1974040	In this case, it says that
1974040	1976020	22 is unfiltered, because it's
1976020	1977680	one of all these other ports.
1978220	1979640	And in this case,
1979640	1982260	we see 22 is open or filtered.
1982260	1983800	So if we have open or filtered
1983800	1985760	on one scan,
1985760	1988300	and unfiltered on the other,
1988300	1990060	you know, that just leaves open.
1990640	1992680	And so, if you combine
1992680	1993940	all of these different results
1993940	1995900	from the two scans,
1995900	1997800	what the hypothesis is,
1997800	2000940	is that 135 and 1434
2003120	2004800	are filtered,
2004800	2006180	but all of these other ones
2006180	2008580	on this huge list are open.
2009380	2010420	And so,
2010860	2012420	you know, that tells you a lot.
2012420	2014100	And you can see a little bit of confirmation
2014100	2016040	in terms of the two that we know
2016040	2017620	are open to the SIN scan,
2017620	2018960	80 and 507.
2019300	2021640	You see here as well,
2021640	2024400	80 and 507 in the open or filtered.
2024400	2025720	So we have a pretty good idea
2025720	2027100	about what we're seeing.
2027100	2028720	But networks can be tricky.
2028720	2030800	It's always good to check your results,
2030800	2033160	try different things, see what's matching up.
2033160	2035600	So let's try yet another type of scan.
2035600	2037540	And that's the Windows scan,
2037540	2040020	which is a little-known scan technique.
2040020	2042300	But it's very similar to the ACK
2042300	2044080	scan, except that it noticed
2044320	2046440	a property that certain hosts have
2046440	2048880	where when you send,
2048880	2049980	when they send a reset
2049980	2052020	back from a probe to one of their
2052020	2054120	open ports, they set the window
2054120	2056140	as they would if it was
2056320	2058800	a SIN ACK for a real connection.
2058800	2060300	Whereas, when they're sending
2060480	2062380	a reset back from a closed port,
2062380	2064460	they set the window to zero.
2064660	2066340	So by looking at that window,
2066340	2068760	TCP receive window value carefully,
2068760	2070240	we can determine which of the
2070240	2072220	ports are open and which are closed.
2072220	2074200	So we do an ACK scan against this
2074200	2076300	machine, and sure enough, like
2076300	2078120	we thought, all the ports are
2078120	2080260	open except 135 is filtered
2080260	2081940	and I think
2081940	2084080	443 is the other one.
2084080	2085620	Or no, it was my MS SQL
2086020	2088040	was the other one, 1434
2088860	2090080	was filtered.
2090080	2092420	So that sort of confirms our results now.
2092420	2093960	We've tried a lot of different things,
2093960	2095160	and now we have a good idea
2095160	2097700	where they're open.
2098360	2100180	And it kind of shows the value
2100180	2102120	of taking the SIN scan and
2102120	2104240	seeing it doesn't get you all the results
2104240	2106140	that you want, so you just keep trying
2106140	2108200	different things until you meet your
2108200	2109020	goals.
2110000	2112200	So that was basically
2112200	2114180	our three missions. And so now
2114180	2116160	I'm going to just give a quick overview,
2116160	2118200	since I've got, oh, about five
2118200	2120120	minutes, of some of the new
2120120	2122080	features that I have in the DEF CON
2122080	2123700	version. There's
2123700	2126300	the ARP scanning that we've already talked
2126300	2128520	about, the MAC spoofing.
2128520	2130500	One nice new feature is
2130500	2132580	raw Ethernet packet sending,
2132580	2134620	because raw IP packets can
2134620	2136580	be a huge mess. You know, a lot of systems
2136580	2138600	screw them up, and Microsoft,
2138600	2140320	even worse, they recently banned them
2140320	2143360	with their Windows XP SP2.
2143360	2144600	So now we're saying, well, screw
2144600	2146640	you, Microsoft. We're just going to send
2146640	2148480	at a lower level, and
2148480	2150500	send the Ethernet packets directly.
2150500	2152300	And that should be a lot faster.
2152620	2154340	It also has 350
2154340	2156420	new OS fingerprints, for
2156540	2158600	a total of 1,690
2158600	2160640	from this ACC Amazon
2160640	2162480	WAN concentrator
2162480	2164460	to the Zyxel
2164460	2165800	Zywall.
2166280	2168480	250 new version detection
2168480	2170460	signatures, so there are now
2170460	2172560	1,312 of those,
2172560	2174580	covering 212 protocols,
2174580	2177160	such as SMTP, SNMP,
2177160	2178540	Kazaa, all sorts
2178540	2180380	of bizarre things. It
2180380	2183240	integrates Doug Song's excellent LibDNet,
2183240	2184460	which helps with the
2184460	2186420	raw Ethernet packets sending.
2187400	2188420	Version detection
2188420	2190460	now helps you find
2190460	2192620	OS information.
2192760	2194440	So the version detection now
2194440	2196560	can find three extra
2196560	2198140	things in many cases.
2198140	2200480	If it sees a service that only works on
2200480	2202500	Windows, or if the service responds
2202500	2205120	with a certain platform name,
2205120	2206480	it can now report, Nmap now
2206480	2208460	reports that next to the OS detection
2208460	2210480	results. The OS detection results
2210480	2212340	are this, and version detection
2212340	2214740	says it looks like this OS.
2214780	2216460	And some people would say, hey, combine
2216460	2217780	those to get just one
2219040	2220400	result. But in
2220400	2222300	reality, what you really want is to have
2222300	2224660	both, because they may be distinct.
2224660	2226180	If you're scanning a firewall
2226180	2229360	that proxies to an IIS server,
2229360	2230160	you should get
2230160	2232220	checkpoint firewall one or whatever
2232220	2234600	for the OS detection
2234600	2237180	results via TCP IP fingerprinting,
2237180	2238520	whereas it should say Windows
2238520	2240360	for the application
2240360	2242540	version detection results.
2242540	2244380	And that's pretty common. You'll get the same thing
2244380	2246340	if you're scanning someone's Linksys
2246340	2248220	network, for example, where they've
2248220	2250260	forwarded different ports to
2250260	2251720	different machines.
2253440	2254480	Version detection
2254480	2256140	also now gives device
2256140	2258540	information and host name information,
2258540	2260140	which can be valuable.
2260180	2262280	I broke the Windows support, I'm
2262280	2264340	afraid, for the moment, but
2264340	2266680	that may be fixed eventually.
2267540	2268340	And when
2268340	2269940	it is fixed, though, we'll have
2269940	2272480	the advantages of the raw packet sending.
2273060	2274400	But for the Defcon release,
2274400	2276320	I figured the priority was to get the
2276320	2278240	Unix versions out, and I've tested this
2278240	2280700	one on Linux, OSX,
2280700	2282580	Solaris, FreeBSD.
2283900	2284460	And
2284460	2286300	then there's also quite a few more features,
2286300	2288020	which you can find in the
2288020	2289300	changelog.
2289860	2292200	What's coming next? Well, I'm happy to
2292200	2294340	report that Google has sponsored
2294340	2296300	10 students to work on
2296300	2298200	Nmap for the summer. And yeah,
2298200	2300100	they're student programmers, but some of them are
2300100	2302220	serious students, like PhD students
2302220	2304940	in doing very relevant research.
2305160	2306220	And so that's
2306220	2308240	pretty exciting, and they're working on a whole lot
2308240	2309620	of projects. There were
2310720	2312180	233 applications, and
2312180	2314060	I picked the top 10,
2314060	2316500	and we worked out some pretty cool projects.
2316700	2318140	One of them is Ncat,
2318140	2320240	which is sort of a re-implementation of
2320240	2322320	Netcat, that adds a
2322320	2324380	bunch of new features that I've wanted.
2324380	2326100	You know, things like SSL,
2326100	2328460	IPv6, password protection,
2328960	2329900	there's a connection
2329900	2331940	brokering feature, so that two
2331940	2333560	hosts behind a NAT
2333560	2336440	can connect into the Netcat listener,
2336440	2337960	and then it brokers the communications
2337960	2340020	between them. You know, all sorts of
2340020	2342000	cool features. And you'll find a man
2342000	2343900	page that he's posted so far
2343900	2346700	on the Nmap dev list.
2346780	2347940	And he's working on the
2347940	2350520	implementation. New GUIs.
2350520	2351960	And GUIs sort of sometimes have
2352060	2353980	a reputation as, oh, this is just for
2353980	2355960	newbies who can't remember those hundreds
2355960	2357540	of Nmap options.
2357780	2359940	But these are more advanced user
2359940	2362040	GUIs. They're
2362040	2363840	mostly results viewers. So you've
2363840	2366520	scanned tens of thousands of machines.
2366520	2368280	These make it easier to identify
2368280	2369940	which machines have this port
2369940	2371240	open, or
2371900	2373860	compare the difference between two scans
2373860	2376000	and show me what's changed. You know, features
2376000	2377840	like that. And there are actually
2377840	2379980	two of these SOC
2379980	2382100	students writing independent
2382100	2383280	GUIs.
2383740	2385900	Potential scripting language. I'm not sure
2385900	2387960	if that's going to work out yet or not. But this
2387960	2389620	guy is working on that.
2389920	2391940	And when that is added,
2391940	2393880	we'll probably use that for host discovery
2393880	2395380	stuff. Information gathering
2395860	2398140	as opposed to, you know, trying to add a
2398140	2399980	thousand different vulnerability
2400580	2402260	detection modules. We'll
2402260	2404340	focus on, hey, have a script that does
2404340	2406040	trace route. Have a script that
2406040	2408000	checks whether a proxy is open. Have a
2408000	2409920	script for all these different things
2409920	2411880	that it can look up once Nmap
2411880	2413540	has determined the OS and
2413540	2415800	port service
2415800	2417900	version and such.
2418580	2420140	Windows performance is a
2420140	2422200	big priority. Also
2422520	2424380	I've been chugging away at my
2424380	2426740	Nmap book, which has taken a long
2426740	2428940	time, but I'm pleased to report
2429700	2430240	progress. I've
2430240	2432460	got more than 200 pages of it
2432460	2434360	here now, and I
2434360	2436260	think it's looking out to be pretty good.
2437220	2438240	Given how slow
2438240	2440240	publishing is, you know, it'll probably be six
2440240	2442380	months, but I've
2442380	2444140	added a bunch of cool network
2444140	2446200	scanning goodies and corny jokes
2446200	2448060	so it'll be great.
2449520	2450580	There's a
2450580	2452740	hyphen hyphen reason option I would like
2452740	2455120	to add, so that Nmap
2455120	2456680	can say, hey, we think this
2456680	2458920	port is closed because we received
2458920	2460440	a reset back. We think
2460440	2462880	it's filtered because we received
2462880	2464160	nothing back, or because we received an
2464160	2465680	ICMP port unreachable
2465680	2467780	or destination unreachable
2467780	2470360	message back. So that'll be useful
2470360	2471940	for more understanding
2471940	2473840	what's going on under the covers.
2473980	2476540	And then I might add proxy and sock scanning.
2477380	2478340	So that's
2478340	2479980	basically my presentation, which is good
2479980	2481900	because I'm about out of time. I'll just take
2481900	2484220	two questions here, if anyone has them.
2489900	2490560	Yes,
2490560	2492500	I'll put the slides...
2497770	2498510	Yeah.
2498870	2501110	Yes, docserv.caldera.com
2502330	2503490	No.
2504370	2505270	Right now I have
2505270	2506950	the new version of Nmap up here
2506950	2509340	at presentation slash defcon.13
2510170	2511370	and I'll put
2511370	2513470	the slides up there shortly as well.
2513490	2515030	Thank you very much.